require 'bit-struct'

class NetFlow_Header_V7 < BitStruct
    unsigned    :version,      16,     "Version"
    unsigned    :count,        16,     "record count"
    unsigned    :uptime,       32,     "uptime"
    unsigned    :unix_secs,    32,     "unix seconds"
    unsigned    :unix_nsecs,   32,     "unix nano-seconds"
    unsigned    :flow_sequence,32,     "flow sequence"
    rest        :reserved, ""

    note "NetFlow Header"
end

class NetFlow_Record_V7 < BitStruct
   unsigned :src_address, 32, "source address"
   #octets :src_address, 32, "source address"
   unsigned :dst_address, 32, "destination address"
   #octets :dst_address, 32, "destination address"
   unsigned :next_hop,    32, "next hop router"
   unsigned :input,       16, "snmp"
   unsigned :output,      16, ""
   unsigned :dPkts,       32, "packets in the flow"
   unsigned :dOctets,     32, "Total number of Layer 3 bytes in the packets of the flow"
   unsigned :first,       32, "first sysuptime at start of flow"
   unsigned :last,        32, ""
   unsigned :src_port,    16, "source port"
   unsigned :dst_port,    16, "dst port"
   unsigned :pad1,         8, ""
   unsigned :tcp_flags,    8, ""
   unsigned :prot,         8, "ip protocol type"
   unsigned :tos,          8, "ip type of service"
   unsigned :src_as,      16, "as number of source"
   unsigned :dst_as,      16, "as number of destination"
   unsigned :src_mask,     8, "source address prefix mask"
   unsigned :dst_mask,     8, "source address prefix mask"
   unsigned :flags,       16, "flags"
   unsigned :router_sc,   32, "ip addres of the router that is bypassed"
end

